docker compose -f /opt/mailcow-dockerized/docker-compose.yml exec dovecot-mailcow doveadm who
List active IMAP and POP3 sessions
doveadm who shows currently connected clients with their username, protocol, and source IP. Handy for spotting a mailbox that is open from many IPs, a sign of a leaked password. Pair it with doveadm kick to disconnect suspicious sessions.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.